Privacy Policy

Last updated: 18 August 2026

1. Controller

The controller responsible for the processing of personal data in connection with this Git server is:

Qubify
Vienna, Austria

Email: dataprotection@qubify.at

2. Purpose of This Git server

We operate this Git server based on Gitea primarily for software development, source-code management, issue tracking, software delivery and the distribution of software releases.

Depending on their authorisation, users may access the instance to:

  • view software source code;
  • view project documentation;
  • view and create issues;
  • communicate with us regarding software-related matters;
  • download source-code deliveries;
  • download compiled, implemented or otherwise packaged software releases.

Developers may additionally use the Git server for development and collaboration, including:

  • creating and modifying repositories;
  • creating commits;
  • submitting pull requests;
  • reviewing code;
  • commenting on issues and pull requests;
  • maintaining project documentation;
  • managing releases and software deliveries.

3. Categories of Users

The Git server may process personal data relating to two principal categories of users.

3.1 External Users and Customers

External users may be granted access to the Git server for purposes such as viewing source code, downloading software releases and submitting or viewing issues.

Depending on the configuration of the relevant project, external users may have read-only access or may be authorised to create and participate in issues.

External users are not authorised to modify source-code repositories or create software commits unless expressly agreed otherwise.

3.2 Developers

Internal developers and authorised external developers may use the Git server as part of their professional activities.

Their activities may include creating commits, modifying source code, reviewing code, managing issues and pull requests, creating releases and maintaining project documentation.

Consequently, personal data relating to internal developers may become part of the permanent technical history of a software project.

4. Personal Data Processed

Depending on the type of user and the activities performed, the following categories of personal data may be processed:

Account and identification data

  • username;
  • name;
  • email address;
  • organisation or company affiliation, where provided;
  • user role and access permissions;
  • account status.

Technical and security data

  • IP address;
  • date and time of access;
  • login and authentication information;
  • browser or client information;
  • connection information;
  • security and audit logs;
  • error and diagnostic information.

Project and collaboration data

Depending on the user’s activities, this may include:

  • issues and issue comments;
  • pull requests and pull-request comments;
  • commit author and committer information;
  • commit messages;
  • code-review information;
  • repository activity;
  • release and deployment information;
  • project documentation;
  • other information voluntarily entered into the Git server.

5. Source Code, Commits and Public Project Information

Source code, commit history, issue discussions, documentation and release information may be visible to authorised users of the relevant repositories.

For internal developers, a developer’s name, username, email address or other identifying information may become permanently associated with commits, code reviews, issue discussions or other elements of the project’s version history.

This is inherent to the operation of a version-control system and is necessary to maintain the integrity, traceability and accountability of software development.

We therefore do not routinely alter or remove historical authorship information from commits merely because an employee or other contributor subsequently requests deletion of their personal data, where retaining that information is necessary to preserve the integrity of the version history.

Where legally required and technically appropriate, we will assess requests for correction, restriction or deletion individually.

6. Issues and Customer Communication

External customers and authorised users may be permitted to create issues in connection with our products and services.

Information voluntarily submitted in an issue may include:

  • the user’s name or username;
  • contact information;
  • descriptions of problems or requests;
  • technical information;
  • screenshots or attachments;
  • other information voluntarily provided by the user.

Users should avoid submitting unnecessary personal data into issues.

Issues and their contents may be visible to other authorised users of the relevant repository. Depending on the repository configuration, certain issue information may also be publicly accessible.

We therefore recommend that users do not include passwords, authentication credentials, payment information, health information or other sensitive personal information in issues.

If sensitive or confidential information needs to be communicated to us, users should contact us directly through an appropriate private communication channel.

7. Downloading Source Code and Software Releases

Customers and external users may access the Git server to download source-code deliveries, compiled software, implemented releases or other software packages.

A download may result in the processing of technical information such as:

  • IP address;
  • date and time of the download;
  • requested repository, file or release;
  • technical connection information;
  • server logs and security information.

These technical data are processed primarily to provide the requested content and to maintain the security, stability and availability of the Git server.

8. Development

Developers may use the Git server as part of their employment and professional duties.

Their personal data may therefore appear in:

  • commit metadata;
  • commit messages;
  • pull requests;
  • code reviews;
  • issues and issue comments;
  • repository history;
  • release metadata;
  • project documentation;
  • technical audit logs.

The processing of this information is necessary for software development, collaboration, quality assurance, security, accountability and maintaining a reliable and traceable development history.

Where applicable, the legal basis for processing employee data is determined in accordance with the applicable employment and data-protection laws.

Depending on the circumstances, processing may be based on:

  • Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or for steps taken at the request of a data subject prior to entering into a contract;
  • Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation;
  • Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests, including operating, securing and maintaining the infrastructure, managing software development, maintaining version history, preventing abuse and ensuring the integrity of our systems;
  • applicable employment-law provisions where personal data of employees is processed in the context of the employment relationship.

Where processing is based on legitimate interests, we carefully balance those interests against the rights and freedoms of the affected individuals.

10. Server Logs and Technical Monitoring

The Git server necessarily generates technical logs for security, troubleshooting and operational purposes.

These may contain:

  • IP addresses;
  • timestamps;
  • requested resources;
  • authentication events;
  • technical error information;
  • security-related events.

We retain server and security logs only for as long as reasonably necessary for the relevant security, operational or legal purpose.

Where technically feasible, routine access logs containing IP addresses are retained for no more than 14 days.

Longer retention may occur where specific security incidents, legal obligations or other legitimate circumstances require preservation of relevant information.

11. Cookies and Session Data

The Git server may use technically necessary cookies and session mechanisms to provide authenticated access and maintain the functionality and security of the service.

We do not use cookies on this Git server for third-party advertising or cross-site behavioural tracking.

Where technically necessary cookies are used, they are processed solely for the operation, security and functionality of the Git service.

12. Data Sharing and Recipients

Personal data may be processed or accessed by:

  • authorised developers;
  • authorised administrators;
  • our hosting provider, to the extent technically necessary to provide and maintain the underlying server infrastructure;
  • service providers acting as processors on our behalf, where applicable;
  • competent authorities where disclosure is legally required.

We do not sell personal data.

We do not provide personal data to third parties for unrelated advertising or behavioural profiling.

13. Hosting and Data Processing

The Git server is operated on virtual server infrastructure provided by a professional hosting provider located in Germany.

Where the hosting provider processes personal data on our behalf, the relevant processing is governed by an appropriate data processing agreement pursuant to Article 28 GDPR, where applicable.

The hosting provider is not authorised to use personal data processed through the Git server for its own unrelated purposes.

14. International Data Transfers

We aim to process personal data within the European Economic Area (EEA).

Where personal data is transferred to a country outside the EEA, we will ensure that the requirements of Chapter V GDPR are fulfilled using an applicable lawful transfer mechanism, such as an adequacy decision or appropriate safeguards.

15. Data Retention

We apply data minimisation and retention principles and retain personal data only for as long as necessary for the relevant purpose or as required by law.

Different categories of data may therefore have different retention periods.

In particular:

  • routine technical access logs containing IP addresses are retained for no more than 14 days, where technically feasible;
  • user account data is retained for as long as the account is required for the relevant purpose;
  • issue and project information is retained for as long as necessary for project operation, support, documentation and accountability;
  • source-code and release information may be retained for the lifetime of the relevant project;
  • commit metadata and version-control history may be retained for as long as necessary to preserve the integrity and traceability of the software development history;
  • employee-related information is retained in accordance with applicable employment, tax and statutory retention requirements.

Deletion of an account does not necessarily result in deletion of historical project data, commits or other information where continued retention is necessary to preserve the integrity of the project history or is otherwise legally justified.

16. Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Depending on the requirements of the service, these measures include:

  • authentication and access controls;
  • role-based permissions;
  • secure network configuration;
  • security updates;
  • firewalling and network protection;
  • encrypted connections where appropriate;
  • backup and recovery mechanisms;
  • monitoring and security logging;
  • restriction of administrative access.

Access to repositories and personal data is restricted according to the principle of least privilege wherever reasonably possible.

17. User Responsibilities

Users are responsible for ensuring that information they submit to the Git server is appropriate for the intended purpose.

In particular, users should not submit unnecessary personal data to public or shared repositories, issues, comments, source code, documentation or other publicly accessible areas.

Users should never submit passwords, private keys, authentication tokens, payment information or other confidential credentials to issues, repositories or other content.

18. Your Rights Under the GDPR

Subject to the applicable legal requirements, you have the following rights:

  • Right of access to personal data concerning you;
  • Right to rectification of inaccurate or incomplete personal data;
  • Right to erasure of personal data where the applicable requirements are met;
  • Right to restriction of processing where the applicable requirements are met;
  • Right to data portability, where applicable;
  • Right to object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation;
  • Right to withdraw consent, where processing is based on consent.

The exercise of these rights may be subject to limitations where continued processing is required by law or is necessary for legitimate purposes such as maintaining the integrity and security of software development records.

19. Requests for Access, Correction or Deletion

You may request access to, correction of or deletion of personal data concerning you by contacting:

dataprotection@qubify.at

Please describe your request as specifically as reasonably possible so that we can identify the relevant account, repository, issue, commit or other information.

We may need to verify your identity before processing a request.

We will assess and respond to requests in accordance with the GDPR and other applicable data-protection laws.

20. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data violates applicable data-protection law.

You may contact the supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.

21. Changes to This Privacy Policy

We may update this Privacy Policy where necessary to reflect changes to the Git server, our processing activities, technical infrastructure or applicable legal requirements.

The current version will be made available through the Git server.

Last updated: 18 August 2026